linux-kernel - Re: [PATCH next] trace/blktrace: fix task hung in blk_trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 3 Dec 2023 19:45:30 +0800
From:   Pengfei Xu <pengfei.xu@...el.com>
To:     Steven Rostedt <rostedt@...dmis.org>
CC:     Yu Kuai <yukuai1@...weicloud.com>,
        Edward Adam Davis <eadavis@...com>,
        "syzbot+ed812ed461471ab17a0c@...kaller.appspotmail.com" 
        <syzbot+ed812ed461471ab17a0c@...kaller.appspotmail.com>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "axboe@...nel.dk" <axboe@...nel.dk>,
        "dvyukov@...gle.com" <dvyukov@...gle.com>,
        "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-trace-kernel@...r.kernel.org" 
        <linux-trace-kernel@...r.kernel.org>,
        "mhiramat@...nel.org" <mhiramat@...nel.org>,
        "syzkaller-bugs@...glegroups.com" <syzkaller-bugs@...glegroups.com>,
        "yukuai (C)" <yukuai3@...wei.com>, <andreyknvl@...gle.com>,
        <balbi@...nel.org>, <heng.su@...el.com>
Subject: Re: [PATCH next] trace/blktrace: fix task hung in blk_trace_ioctl

Hi,

On 2023-12-03 at 06:07:43 +0800, Steven Rostedt wrote:
> On Sat, 2 Dec 2023 17:19:25 +0800
> Yu Kuai <yukuai1@...weicloud.com> wrote:
> 
> > Hi,
> > 
> > 在 2023/12/02 17:01, Edward Adam Davis 写道:
> > > The reproducer involves running test programs on multiple processors separately,
> > > in order to enter blkdev_ioctl() and ultimately reach blk_trace_ioctl() through
> > > two different paths, triggering an AA deadlock.
> > > 
> > > 	CPU0						CPU1
> > > 	---						---
> > > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > > 	mutex_lock(&q->debugfs_mutex)			mutex_lock(&q->debugfs_mutex)
> > > 
> > > 
> > > The first path:
> > > blkdev_ioctl()->
> > > 	blk_trace_ioctl()->
> > > 		mutex_lock(&q->debugfs_mutex)
> > > 
> > > The second path:
> > > blkdev_ioctl()->				
> > > 	blkdev_common_ioctl()->
> > > 		blk_trace_ioctl()->
> > > 			mutex_lock(&q->debugfs_mutex)  
> > I still don't understand how this AA deadlock is triggered, does the
> > 'debugfs_mutex' already held before calling blk_trace_ioctl()?
> 
> Right, I don't see where the mutex is taken twice. You don't need two
> paths for an AA lock, you only need one.
> 
> > 
> > > 
> > > The solution I have proposed is to exit blk_trace_ioctl() to avoid AA locks if
> > > a task has already obtained debugfs_mutex.
> > > 
> > > Fixes: 0d345996e4cb ("x86/kernel: increase kcov coverage under arch/x86/kernel folder")
> 
> How does it fix the above? I don't see how the above is even related to this.

I bisected this issue and the following fix information is more accurate:
"
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
"

All the bisected info is in link: https://github.com/xupengfe/syzkaller_logs/tree/main/231203_140738_blk_trace_ioctl

Acked-by: Pengfei Xu <pengfei.xu@...el.com>

Thanks!

> 
> -- Steve
> 
> > > Reported-and-tested-by: syzbot+ed812ed461471ab17a0c@...kaller.appspotmail.com
> > > Signed-off-by: Edward Adam Davis <eadavis@...com>
> > > ---
> > >   kernel/trace/blktrace.c | 3 ++-
> > >   1 file changed, 2 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c